Remove extra avp bit from diameter_avp decode

In the case of a faulty AVP Length (pointing past the end of a message
or not spanning the header), an extra bit is prepended to data bytes in
diameter_avp:collect_avps/1 in order to force a 5014 decode error. The
bit is supposed to be removed as part of the decode in diameter_gen.hrl
but this didn't happen in case of an AVP that unknown to the dictionary
in question.

1 files changed, 7 insertions, 3 deletions

diff --git a/lib/diameter/src/base/diameter_codec.erl b/lib/diameter/src/base/diameter_codec.erl
index 15a4c5e86f..bf2fe8e7ca 100644
--- a/lib/diameter/src/base/diameter_codec.erl
+++ b/lib/diameter/src/base/diameter_codec.erl
@@ -640,8 +640,12 @@ split_data(Bin, Len) ->
             %% payload if this is a request. Do this (in cases that we
             %% know the type) by inducing a decode failure and letting
             %% the dictionary's decode (in diameter_gen) deal with it.
-            %% Here we don't know type. If the type isn't known, then
-            %% the decode just strips the extra bit.
+            %%
+            %% Note that the extra bit can only occur in the trailing
+            %% AVP of a message or Grouped AVP, since a faulty AVP
+            %% Length is otherwise indistinguishable from a correct
+            %% one here, since we don't know the types of the AVPs
+            %% being extracted.
             {<<0:1, Bin/binary>>, <<>>}
     end.
 
@@ -690,8 +694,8 @@ pack_avp(#diameter_avp{code = undefined, data = B})
     Len = size(<<H:5/binary, _:24, T/binary>> = <<B/binary, 0:Pad>>),
     <<H/binary, Len:24, T/binary>>;
 
-%% ... from a dictionary compiled against old code in diameter_gen ...
 %% ... when ignoring errors in Failed-AVP ...
+%% ... during a relay encode ...
 pack_avp(#diameter_avp{data = <<0:1, B/binary>>} = A) ->
     pack_avp(A#diameter_avp{data = B});